CVE-2025-48487

MEDIUM

FreeScout < 1.8.180 - Stored Cross-Site Scripting via Flash Message Translation

Title source: llm

Description

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, when creating a translation of a phrase that appears in a flash-message after a completed action, it is possible to inject a payload to exploit XSS vulnerability. This issue has been patched in version 1.8.180.

References (1)

Core 1

Core References

Exploit, Vendor Advisory x_refsource_confirm

https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-wg2q-m2fj-x6j4

Scores

CVSS v3 4.8

EPSS 0.0022

EPSS Percentile 12.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (1)

freescout/freescout < 1.8.180

Published May 30, 2025

Tracked Since Feb 18, 2026